# VaderRouter._swap performs wrong swap

VaderRouter._swap passed the foreign amount as the native argument in 3-path hops, causing all multi-hop swaps to revert.

- Payout: Audit contest
- Severity: high
- Program: Vader Protocol
- Found by: cmichel
- Disclosed: 2022-02-10
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2021-11-vader-findings/issues/161
- Library page: https://bugbountylibrary.com/r/c4%3A2021-11-vader%3AH-15
- Tags: area:web3 domain:web3 impact:dos kind:contest platform:code4rena sev:high tech:solidity technique:source-review vuln:business-logic

**Target:** VaderRouter._swap / pool.swap router
**Root cause:** In the 3-path branch, pool0.swap is called with (amountIn, 0) instead of (0, amountIn), so the foreign amount is supplied as nativeAmountIn while the pool expects it as the second (foreign) argument.
**Steps:**
1. Call VaderRouter._swap with a 3-element path (foreign -> native -> foreign).
2. Observe the code executes `pool1.swap(0, pool0.swap(amountIn, 0, address(pool1)), to)`.
3. pool0.swap receives nativeAmountIn=amountIn and foreignAmountIn=0, so the native balance check `nativeAmountIn <= nativeBalance - nativeReserve` fails and the swap reverts.
**How found:** Code reading of the 3-path branch in _swap, comparing the positional argument order against pool.swap's (nativeAmountIn, foreignAmountIn) signature.
**Insight:** When a router forwards amounts into a pool with positional args, verify each branch's argument order against the pool signature; multi-hop branches are commonly copy-pasted and misordered.